9681f60064bcf9cb185d49d8fc355fa75daef418188f0a20db66a96884f14733.exe

BENIGN

Mal-ecule

Size 1.2 MB download

First seen 111 days ago

Analyzed 95 days ago

Objectives

anti-analysis/vm-detect Regex component marker

anti-static/obfuscation/binary-metrics Binary has normal code entropy (>5.5)

anti-static/obfuscation/payload PE version resource text

anti-static/pack Large near-high entropy .text section

command-and-control/infrastructure Binary has 4 or fewer sections

evasion/indicator-removal Regex component marker

evasion/masquerade/file Filename has EXE extension

evasion/masquerade/identity Two dotted-quad version strings

evasion/masquerade/version-resource Regex component marker

evasion/process/injection Regex component marker

os/api-resolution Multiplicative hash inner loop (imul, shr, xor)

binary/section Large high-entropy random executable section

binary PE has RT_ICON in resources list

binary/metrics Binary has 1000 or more strings

dotnet .NET assembly detected via BSJB CLR metadata signature

dylib::mscoree links mscoree (CorExeMain)

hardening ASLR enabled (DYNAMIC_BASE)

lang/compiler mscorlib reference

package Large binary with few DLL dependencies

binary/anomaly PE version info numeric fields present

20 of 37 traits shown

SHA-256	9681f60064bcf9cb185d49d8fc355fa75daef418188f0a20db66a96884f14733
Filename	9681f60064bcf9cb185d49d8fc355fa75daef418188f0a20db66a96884f14733.exe

Source	harvest

Not seeing what you expected? Let us know